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11 .  (SBU)  Summary:  In  a brief  February  22  meeting.  National 
Security  Council  Secretariat  Joint  Secretary  Arvind  Gupta  and 
Deputy  Director  (Information  Security)  Commander  Mukesh  Saini 
were  upbeat  on  US-India  cybersecurity  cooperation,  clarified 
the  objective  of  the  upcoming  April  18-19  Cybersecurity 
Seminar  in  New  Delhi,  and  demonstrated  that  the  GOI  is 
educating  the  Indian  legal  system  on  cybersecurity  and 
related  issues.  They  also  outlined  some  of  the  strengths  and 
weaknesses  of  the  Indian  IT  Act  (2000)  and  described  the 
December  17  arrest  of  Baazee.com  CEO  Avnish  Bajaj  as  a case 
of  inadequate  police  training  on  IT  issues  — an  area  they 
say  they  are  trying  to  improve.  Gupta  also  outlined  how  the 
NSCS  became  the  GOI ' s cybersecurity  nodal  agency. 

Separately,  President  Kalam  in  a recent  address  at  the 
National  Judicial  Academy  underlined  the  importance  of  India 
having  a robust  cyber security  regime.  End  Summary. 

GOI  Very  Upbeat  on  Cyber-Cooperation 


12.  (SBU)  J/S  Gupta  opened  February  22  discussion  by  with 
Poloff  comparing  the  upcoming  April  18-19  Cybersecurity 
Seminar  (Ref  B)  in  New  Delhi  to  last  November's  Cybersecurity 
Forum:  "We  shared  our  concerns  then,  now  we  will  share 
information  and  cooperation."  He  also  welcomed  what  he 
termed  "growing  IT  interdependence"  as  part  of  expanding  the 
overall  US-India  relationship,  adding  that,  "The  logic  of 
markets  and  the  logic  of  globalization  make  cybersecurity 
cooperation  a necessary  win-win  situation." 

Goal  of  April  Seminar 


13.  (SBU)  Gupta  then  explained  that  the  goal  of  the  April 
seminar  is  to  address  US  concerns  regarding  Indian  legal 
issues  in  the  cybersecurity  arena,  including  for  example  the 
IT  Act  (2000),  the  Evidence  Act,  the  Criminal  and  Civil  Penal 
Codes,  digital  evidence,  data  privacy,  and  confidentiality. 

"I  was  surprised,  for  example,  on  how  far  Indian  industry  was 
ahead  of  law  enforcement  regarding  due  diligence,"  he 
expanded,  noting  that  firms  need  to  be  very  sensitive  due  to 
their  high  level  of  accountability. 

Serious  about  Cybersecurity  Legal  Training 


14.  (SBU)  Although  Gupta  had  no  data  on  how  much  is  budgeted 
nationally  for  cyber security , he  pointed  out  that  related 
classes  are  taught  at  the  Indian  Institutes  of  Science  and 
that  the  Indian  Institutes  of  Technology  offer  both  courses 
and  research  opportunities.  The  Department  of  Information 
Technology  also  funds  cybersecurity  research  projects,  as 
does  the  Banking  Research  Institute,  he  added.  Cdr.  Saini 
reiterated  GOI  interest  in  on-site  co-training  in  both  India 
and  the  US  (Ref  D),  and  on  cooperation  in  tackling  the  "hard 
problems"  list. 

15.  (SBU)  Gupta  told  Poloff  that  the  National  Judicial 
Academy  in  Bhopal  is  training  new  and  current  judges  in 
cyberlaw.  The  training  includes  a layperson's  overview  of 
the  technological  possibilities  and  limits  of  IT,  as  well  as 
training  on  India's  IT  laws.  Separately,  the  "Hindustan 
Times"  on  February  25  reported  that  the  first  class  of  a 
dozen  lower  court  judges  in  New  Delhi  had  just  completed  a 
three-day  seminar  on  IT  and  law  as  part  of  its  obligations  as 
a signatory  to  the  UN  Commission  on  International  Trade  Law. 
Their  program  included  overviews  of  steganography , 
encryption,  digital  signatures,  website  defacing,  and 
recovery  of  digital  data  as  evidence.  Gupta  hopes  to  have 
some  recently-cybertrained  judges  attend  the  April  Seminar. 

16.  (U)  Separately,  in  a February  19  address  to  the  Judicial 
Colloquium  on  Science,  Laws,  and  Ethics  at  the  National 
Judiciary  Academy,  President  AJP  Abdul  Kalam  offered  the 
following  remarks  on  modernizing  India's  cyber  laws  and  cyber 


capabilities:  "India's  cyber  laws  need  to  look  at  the  fact 
that  nowadays  nations  are  electronically  connected,  with  all 
their  electronic  assets.  Defense  and  national  security 
establishments  will  be  targets  for  cyber  attacks  during  a 
conflict.  In  such  a situation,  a country  can  be  defeated 
without  a missile  or  aircraft  attack,  just  through 
intelligent  cyber  war.  Hence  it  is  essential  to  generate  a 
model  of  the  connected  economic  and  defense  security  system 
as  a cyber/electronic  network.  This  will  reveal  the  need  for 
a new  policy  with  redundancy  and  restriction  of  external 
connectivity  and  external  partnership  of  certain  vital 
establishments . " 

IT  Act  "India's  Most  Comprehensive  Cyber security  Tool" 


1.7.  (SBU)  The  most  comprehensive  legal  tool  New  Delhi  has  for 
cybersecurity  is  the  IT  Act  (2000),  Gupta  told  Poloff.  This 
statute  being  revisited,  he  said,  and  may  be  amended  to 
account  for  changes  in  technology  and  to  incorporate  lessons 
learned,  but  it  is  "robust  enough  and  impartial  enough  to 
address  the  situation"  and  it  "rests  on  a solid  foundation  of 
Indian  civil  and  criminal  law  traditions."  Gupta  underlined 
that  the  problems  with  the  IT  Act  were  that  law  always  lags 
behind  technology,  and  that  law  is  bound  by  borders  while  IT 
is  not.  "In  the  UK,  Australia,  the  US,  the  problems  are  the 
same  but  the  laws  are  different,"  he  added.  Gupta  expected 
that  the  US  delegation  to  the  April  seminar  would  have  many 
questions  regarding  the  IT  Act. 

Baazee.com  Arrest  Blamed  on  Inadequate  Training 


1.8.  (SBU)  When  asked  if  the  IT  Act  would  be  amended  in  light 
of  the  December  17  arrest  of  Baazee.com  CEO  Avnish  Bajaj  (Ref 
C),  Gupta  answered  that  his  office  was  surprised  when  the 
arrest  happened,  and  he  noted  that  it  drew  extensive 
criticism  from  the  Indian  IT  sector  as  well  as  from  foreign 
IT  firms.  Saini  commented  that  the  issue  was  not  the  IT  Law 
itself  but  the  poor  police  training  that  led  to,  as  he  viewed 
it,  "improper  implementation  of  the  law."  Gupta  continued 
that  a major  drawback  with  the  IT  Law  is  that  even  after 
almost  five  years  it  lacks  a substantial  body  of  case  law  to 
guide  the  police  and  the  courts.  Observing  that  "Personally, 
I think  the  arrest  was  a mistake,"  Gupta  reiterated  the 
importance  of  training  judges,  police,  investigators,  and 
attorneys  on  the  law,  and  asked  if  we  could  provide  US 
cybercrime  cases  that  could  be  used  as  references  as  India 
develops  its  own  case  law.  (Note:  Mission  is  following  up  on 
this.  End  note.)  He  reiterated  that  the  law  is  being 
revisited  and  the  case  is  currently  in  the  courts  where  it 
will  continue  to  unfold.  He  expected  the  US  delegation  in 
April  to  discuss  this  case  as  well. 

Where  the  NSCS  Fits  in  the  G0I 


19.  (SBU)  Gupta  concluded  by  outlining  NSCS ' s overarching 
function  as  supporting  the  NSC  and  NSA  MK  Narayanan  (Ref  A), 
and  providing  independent  inputs  on  both  traditional  and 
non-traditional  security  issues,  including  cyber security . As 
such,  the  NSCS  takes  the  lead  in  coordinating  with  agencies 
throughout  the  GOI  on  national  information  security  policy, 
including  the  Department  of  Telecommunications,  the 
Department  of  Information  Technology,  and  the  Ministries  of 
Law  and  Home  Affairs,  as  well  as  academia  and  private 
industry.  In  the  area  of  international  cybersecurity 
cooperation,  he  said  that  New  Delhi's  relations  with 
Washington  are  "the  strongest  we  have;"  although  in  this 
meeting  he  only  specified  cybersecurity  cooperation  with 
China,  in  the  past  our  GOI  cyber security  interlocutors  have 
referenced  relationships  with  Canada,  Russia  and  Israel  (Ref 
D). 

Comment 


1.10.  (SBU)  The  brief  NSCS  conversation  and  President  Kalam's 
remarks  demonstrate  that  the  GOI  understands  that  the 
US-India  Cybersecurity  Forum  can  provide  New  Delhi  with  the 
training  and  contacts  to  help  it  nourish  India's  growing 
information  economy  and  make  its  governmental  organization 
and  policies  regarding  cybersecurity  more  sophisticated.  It 
provides  another  strand  in  the  web  of  functional  relations 
that  strengthens  the  US-India  government-to-government 
dynamic.  The  US-India  cybersecurity  relationship  will 
require  careful  nurturing  from  both  sides  to  ensure  the 
working  groups  fulfill  their  potential,  as  well  as  complete 
their  stated  goals  and  objectives.  However,  the  groundwork 
has  been  laid  for  a long-standing  and  robust  cyber  exchange 
with  important  political  and  commercial  benefits. 
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